The first round Wietse fixed was a few months ago in https://www.openwall.com/lists/oss-security/2026/05/04/25.
See his summary below for details, but they're all at most DoS.
-------------------- Start of forwarded message -------------------- To: Postfix announce <postfix-announce () postfix org> Date: Mon, 10 Aug 2026 11:50:35 -0400 (EDT) CC: Postfix users <postfix-users () postfix org> Subject: [pfx] Postfix stable release 3.11.6 and legacy releases 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, 3.5.27 From: Wietse Venema via Postfix-users <postfix-users () postfix org>
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.6.html]
This release addresses medium-impact problems that need to be fixed as some enable remote DOS or policy bypass.
The fixes below, and more, are also released in the unstable version postfix-3.12-20260809.
In addition to updated releases for the supported Postfix versions 3.8-3.11, releases will also be available for the out-of-support Postfix versions 3.5-3.7. NOTE: these do not include the patches for out-of-support Postfix versions that have been issued for "large SMTP inputs (June 2026)", "TLSA parsing (June 2026)", and "SMTP smuggling fixes". Those patches still need to be applied.
These defects were found by Qualys assisted by Claude Mythos Preview, and by OpenAI Security; more than half date from 20 or more years ago. When I implemented Postfix, I knew that there were going to be mistakes. That is the reason why Postfix has its architecture and safety nets. The number of defects may seem large, but considering that they were found in a code base of over 150 thousand lines, the error rate is still lower than what I designed for.
Policy bypass:
Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP server resets of MAIL FROM and RCPT TO command state after smtpdendofdatarestrictions rejected a message. This resulted in SMTP protocol state desynchronization between the remote SMTP client and the Postfix SMTP server.
A crafted remote SMTP client could then send RCPT TO and DATA without MAIL FROM, and deliver a second message. Then, smtpdendofdatarestrictions skipped checkrecipientaccess constraints, because a recipient counter was > 1. Reported by OpenAI Security. File: smtpd/smtpd.c.
As reported by OpenAI Security, the failure to reset MAIL FROM and RCPT TO state also affected Milter support (added in Postfix 2.3). Here, after a Milter replied with "accept this message" based on the message envelope, and smtpdendofdatarestrictions rejected the message, the Postfix SMTP server as before accepted RCPT TO and DATA without MAIL FROM, and smtpdendofdatarestrictions as before skipped checkrecipientaccess constraints for the second message. Under these conditions, the Postfix Milter client remained in the "accept this message" state, skipping Milter policy enforcement for the second message.
Denial of service:
Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP server command history memory exhaustion with a large number of very small BDAT requests. Reported by OpenAI security. File: smtpd.c.
Bug (defect introduced: Postfix 1.1, date: 20021116): address verification cache poisoning. A local user could use the postdrop command to submit an address verification probe with envelope or message content that Postfix rejected later, resulting in a negative address verification cache entry for that address. On systems that enable address verification, the negative address verification cache entry would force the Postfix SMTP server to reject a message that it should accept (denial of service). Problem reported by OpenAI Security. File: postdrop.c.
Server crashes and panic()s:
Bug (defect introduced: Postfix 3.4, date: 20180805): missing SMTP server reset of RCPT TO state, after a BDAT command error. A crafted remote SMTP client could then send a DATA command without MAIL FROM or RCPT TO, and crash a Postfix SMTP daemon process with a null pointer read error. Reported by OpenAI Security. File: smtpd/smtpd.c.
Bug (defect introduced: Postfix 2.4, date: 20051222): null pointer read crash while parsing a malformed Dovecot AUTH server response. Reported by Qualys, assisted by Claude Mythos Preview. File: xsasldovecotserver.c.
Read after free, uninitialized read, under/over read:
Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free in the PSCCALLBACKNOTIFY() macro. This had no effect on program execution, because myfree() wiped memory, and that memory was not yet reused. Problem reported by Qualys, assisted by Claude Mythos Preview. File: postscreendnsbl.c.
Read after free (no privilege escalation) in debug logging (defect introduced: Postfix 2.2, date: 20050117). Reported by Qualys, assisted by Claude Mythos Preview. File: util/inetconnect.c.
Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized memory read in postscreen HaProxy client after remote I/O exception, causing garbage to be logged. Reported by Qualys, assisted by Claude Mythos Preview. File: postscreenhaproxy.c.
Latent bug (defect introduced: Postfix 2.7, date: 20090618): uninitialized memory read after dnsblog(8) returns a string that is not an IPv4 address. Reported by Qualys, assisted by Claude Mythos Preview. File: postscreendnsbl.c.
Bug (defect introduced: before Postfix alpha, date 19970424): the DNS client could read up to two bytes past the end of an MX record, before discovering that the record was too short. This behavior was later copied with SRV records, potentially over-reading up to six bytes. Problem reported by Qualys, assisted by Claude Mythos Preview. File: dnslookup.c.
Bug (defect introduced: Postfix 1,1, date: 20010524): the postsuper command under-read or over-read a very short queue filename. No crash, information leak, or privilege escalation. Reported by Qualys, assisted by Claude Mythos Preview. Files: postsuper.c, mailqueue.h.
Other code hygiene:
Bug (defect introduced: before Postfix alpha, date: 19971106): 'int' over-shift, in the queue file record-length parser. Postfix programs do not generate such records, but an attacker could cause postdrop to reject input or panic(). Reported by Qualys, assisted by Claude Mythos Preview. File: record.c.
Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive comparison of IPv4 addresses. Reported by Qualys, assisted by Claude Mythos Preview. File: sockaddr.c.
Bug (defect introduced: Postfix 1.0, date: 20000928): the fast flush server, used by the SMTP command "ETRN", and by the commands "postqueue -s site" and "postqueue -i queueid" (and their sendmail(1) equivalents), used the wrong duplicate suppression API, resulting in unnecessary queue scans by the queue manager. Reported by Qualys, assisted by Claude Mythos Preview. File: flush.c.
Queue hygiene: the postdrop command accepted the null record type which the rest of Postfix ignores. Reported by OpenAI Security. File: postdrop.c.
You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.
Wietse Postfix-users mailing list -- postfix-users () postfix org To unsubscribe send an email to postfix-users-leave () postfix org -------------------- End of forwarded message --------------------
On Mon, May 04, 2026 at 05:38:55PM +0100, Sam James wrote: Sam James <sam () gentoo org> writes: The most significant one here seems to be the first entry under "Fixed in Postfix 3.8, 3.9, 3.10:".
-------------------- Start of forwarded message -------------------- To: Postfix announce <postfix-announce () postfix org> Date: Sun, 3 May 2026 19:43:27 -0400 (EDT) CC: Postfix users <postfix-users () postfix org> Subject: [pfx] Postfix stable release 3.11.2 and legacy releases 3.10.9, 3.9.10, 3.8.16 From: Wietse Venema via Postfix-users <postfix-users () postfix org>
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.2.html]
[...] I am interested in feedback on whether using my own judgement is acceptable for bringing these to oss-security, where I believe they may of interest (releases with fixes that appear security-related, as the volume is increasing with the current wave of new tooling ()), or whether there are some guidelines I should apply.
Thanks in advance.
() I of course only plan to bring such things where I plan to treat them at least in part as a security bug downstream. Yes, I think your judgement fits what many of us would like to see on this list. Thank you!
As to this specific issue, I guess Wietse called it a bug and not a vulnerability deliberately. I trust his judgement on this, but I don't mind downstreams being cautious. Per my reading, exposure is limited to other trusted components and impact is not directly security relevant (if only a child process crashes and will be respawned).
Alexander
Hi,
On Mon, May 04, 2026 at 05:35:38PM +0100, Sam James wrote: The most significant one here seems to be the first entry under "Fixed in Postfix 3.8, 3.9, 3.10:". [...] Fixed in Postfix 3.8, 3.9, 3.10:
Bugfix (defect introduced: Postfix 2.3, date: 20050323): buffer over-read when Postfix an enhanced status code is not followed by other text. For example, "5.7.2" without text after the three-number code. This CANNOT be triggered with an SMTP or LMTP server response; is confirmed with an access(5) table and likely with a policy server response; can possibly be triggered with pipe-to-command output, headerchecks(5), bodychecks(5), an error(8) transport in transportmaps, or a milter response; and is confirmed with a DNSBL server TXT response while Postfix is configured with "$rblcode $rbltext" in rblreplymaps or defaultrblreply. This could result in process termination. Problem reported by Kamil Frankowicz. This one got https://www.cve.org/CVERecord?id=CVE-2026-43964 assigned.
Regards, Salvatore
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
Last updated 13 May 2026
Sam James <sam () gentoo org> writes: The most significant one here seems to be the first entry under "Fixed in Postfix 3.8, 3.9, 3.10:".
-------------------- Start of forwarded message -------------------- To: Postfix announce <postfix-announce () postfix org> Date: Sun, 3 May 2026 19:43:27 -0400 (EDT) CC: Postfix users <postfix-users () postfix org> Subject: [pfx] Postfix stable release 3.11.2 and legacy releases 3.10.9, 3.9.10, 3.8.16 From: Wietse Venema via Postfix-users <postfix-users () postfix org>
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.2.html]
[...] I am interested in feedback on whether using my own judgement is acceptable for bringing these to oss-security, where I believe they may of interest (releases with fixes that appear security-related, as the volume is increasing with the current wave of new tooling ()), or whether there are some guidelines I should apply.
Thanks in advance.
() I of course only plan to bring such things where I plan to treat them at least in part as a security bug downstream.
The most significant one here seems to be the first entry under "Fixed in Postfix 3.8, 3.9, 3.10:".
-------------------- Start of forwarded message -------------------- To: Postfix announce <postfix-announce () postfix org> Date: Sun, 3 May 2026 19:43:27 -0400 (EDT) CC: Postfix users <postfix-users () postfix org> Subject: [pfx] Postfix stable release 3.11.2 and legacy releases 3.10.9, 3.9.10, 3.8.16 From: Wietse Venema via Postfix-users <postfix-users () postfix org>
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.2.html]
Fixed in Postfix 3.11:
Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon dereferenced an uninitialized pointer after a request protocol error. This daemon is not exposed to local or remote users. Found by Claude Opus 4.6.
Bugfix (defect introduced: 20260309) a change, to set the servicename default value to "amnesiac", violated a test that parameter names in postconf output must match 1:1 with parameter names in the postlink script.
Fixed in Postfix 3.10:
Bugfix (defect introduced: Postfix 3.10): The RFC 2047 encoder for the sender "full name" could loop when a very long fullnameencodingcharset value was configured in main.cf. Found by Claude Opus 4.6.
Fixed in Postfix 3.8, 3.9, 3.10:
Bugfix (defect introduced: Postfix 2.3, date: 20050323): buffer over-read when Postfix an enhanced status code is not followed by other text. For example, "5.7.2" without text after the three-number code. This CANNOT be triggered with an SMTP or LMTP server response; is confirmed with an access(5) table and likely with a policy server response; can possibly be triggered with pipe-to-command output, headerchecks(5), bodychecks(5), an error(8) transport in transportmaps, or a milter response; and is confirmed with a DNSBL server TXT response while Postfix is configured with "$rblcode $rbltext" in rblreplymaps or defaultrblreply. This could result in process termination. Problem reported by Kamil Frankowicz.
For older Postfix versions, a buffer over-read patch is included at the end of this text.
Code cleanup: log a fatal error instead of dereferencing a null pointer after a first/next cursor initialization failure. Fedor Vorobev. This affected the Berkeley DB client.
Fixed in Postfix 3.8, 3.9, 3.10. 3.11:
Portability: support for recent FreeBSD, NetBSD, and OpenBSD versions. Brad Smith.
Bugfix (defect introduced: Postfix 2.2, date 20041207): When truncating a database file, the cdb: database client looked at the file size from before requesting an exclusive lock on a database file, instead of the file size after the exclusive lock was granted. Found by Claude Opus 4.6.
Bugfix (defect introduced: Postfix alpha, date 19980309): file descriptor leak after fork() failure. Found by Claude Opus 4.6.
Mistakes in debug logging. Found by Claude Opus 4.6. This affected two files in Postfix 3.8 and 3.9, three files in Postfix 3.10 and 3.11.
Unchecked null pointer results after an out-of-memory condition in a library dependency. Found by Claude Opus 4.6. The fix is to return an error status or to log a fatal error. This affected three source files.
Missing or incomplete guards for ssizet or int overflow, found by Claude Opus 4.6. This affected three source files. These limits are unlikely to be exceeded because the size of in-memory objects is limited by design (the number of in-memory objects is also limited).
You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.
Wietse
Buffer over-read patch for Postfix 2.3 .. 3.7:
--- /var/tmp/postfix-3.8.15/src/global/dsnutil.c 2006-01-07 20:28:37.000000000 -0500 +++ src/global/dsnutil.c 2026-05-01 16:59:50.961688175 -0400 @@ -155,5 +155,5 @@ strncpy(dp->dsn.data, cp, len); dp->dsn.data[len] = 0; - cp += len + 1; + cp += len; } else if ((len = dsnvalid(defdsn)) > 0) { strncpy(dp->dsn.data, defdsn, len); Postfix-users mailing list -- postfix-users () postfix org To unsubscribe send an email to postfix-users-leave () postfix org -------------------- End of forwarded message --------------------
Latest version: 3.11.6
Latest version: 3.10.13
End of life: 3/6/2026, Latest version: 3.7.22
End of life: 3/6/2026, Latest version: 3.7.22
Latest version: 3.9.14
Latest version: 3.9.14
Last updated 24 July 2024
Latest version: 3.8.20
Latest version: 3.8.20
End of life: 2/16/2025, Latest version: 3.6.20
End of life: 2/16/2025, Latest version: 3.6.20
End of life: 3/6/2024, Latest version: 3.5.27
End of life: 3/6/2024, Latest version: 3.5.27
It was found that Berkeley DB reads the DBCONFIG configuration file from the current working directory by default. This happens when calling dbcreate() with dbenv=NULL; or using the dbmopen() function.
References:
http://seclists.org/oss-sec/2017/q2/452 http://www.postfix.org/announcements/postfix-3.2.2.html
Proposed patch:
http://seclists.org/oss-sec/2017/q2/475